Re: [quicwg/base-drafts] 5tuple routing (#3536)

[Martin Thomson <[e-mail]>]

@martinthomson commented on this pull request.



> @@ -1156,6 +1156,34 @@ SHOULD ignore any such packets.
 
 Servers MUST drop incoming packets under all other circumstances.
 
+### Considerations for 5-tuple routing architectures
+
+QUIC endpoints can be deployed behind a 5-tuple based routing architecture that
+delivers packets based on both the source and destination IP addresses and
+ports. When routing depends on addresses that the endpoint does not control,
+changes to the IP address or port of peers could result in packets being routed
+to a different server. The following actions could mitigate or resolve
+operational and security issues in this case:
+
+* Endpoints can use an out-of-band mechanism to deliver packets to the correct
+destination or transfer state from the original destination.
+
+* A server can request that a connection be migrated to an address that is
+unique using the preferred_address transport parameter. For example, the initial

That is imprecise.  A connection ID means that you don't rely on 5-tuple routing.  The relevant point is that the destination address of packets is unique - at least for the time that the connection is active.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3536#discussion_r401958312